Binance hack: $6.3B theft may trace to engineer's laptop

Binance is investigating a security breach involving an estimated $6.3 billion in cryptocurrency. Nearly $3 billion has been frozen while investigators examine whether a compromised employee laptop enabled unauthorized withdrawals.

Key takeaways

• Binance estimates $6.3 billion in crypto assets were affected on Oct. 29
• Investigators are examining whether a compromised engineer's laptop enabled withdrawals
• About $3 billion has been frozen; Binance promises to cover losses
• TRM Labs attributes the attack to North Korea's TraderTraitor group

How the Binance hack may have worked

An attacker moved billions of dollars from wallets operated by Binance on Oct. 29, triggering an emergency response at the world's largest cryptocurrency exchange. The company estimates $6.3 billion in assets were affected. The investigation has yet to determine exactly how the attacker gained access and how much money can be recovered.

One possibility is that a DevOps engineer's compromised laptop exposed a service container through which unauthorized withdrawal requests could be submitted. Binance says it has found no evidence that wallet private keys were leaked—attackers may have exploited the systems authorized to move funds rather than stealing the keys guarding them.

Why North Korea is under suspicion

Blockchain intelligence company TRM Labs attributes the operation to TraderTraitor, a North Korean hacking group.

Its analysis traces $6.36 billion leaving Binance wallets across 10 blockchains, potentially making this the biggest cryptocurrency theft on record.

Binance has not independently confirmed that attribution, and its technical investigation is ongoing.

TRM says preparations began at least 36 hours before the theft. It reported that the attackers prepared transaction authorizations in advance, giving them control over an Ethereum wallet's activity. The firm also identified similarities to the February 2025 $1.5 billion Bybit hack.

What Binance users need to know

Binance says industry partners have frozen roughly $3 billion in affected assets. Stablecoin issuers Tether and Circle were among those involved in blocking funds. The exchange suspended deposit and withdrawal services during security checks, revoked affected authorization, and called law enforcement and blockchain investigators to pursue the remaining assets.

Freezing prevents further movement, but it doesn’t return assets to Binance.

The company promises to reimburse losses using its Secure Asset Fund for Users (SAFU) and corporate funds and says customer balances are safe. Nevertheless, users should expect fake support messages, compensation offers, and withdrawal links exploiting the headlines. Check updates directly via the Binance app or website and never disclose recovery phrases or approve unexpected transfers.

A platform breach is beyond an individual customer's control, unlike related scams. To keep safe against scam attempts, Bitdefender Ultimate Security helps flag suspicious links and messages; its Scam Protection Pro feature includes tools to assess questionable emails and supposed support requests.